scan.c

   1 #include <net/if.h>
   2 #include <errno.h>
   3 #include <string.h>
   4 #include <ctype.h>
   5 #include <stdbool.h>
   6
   7 #include <netlink/genl/genl.h>
   8 #include <netlink/genl/family.h>
   9 #include <netlink/genl/ctrl.h>
  10 #include <netlink/msg.h>
  11 #include <netlink/attr.h>
  12
  13 #include "nl80211.h"
  14 #include "iw.h"
  15
  16 #define WLAN_CAPABILITY_ESS             (1<<0)
  17 #define WLAN_CAPABILITY_IBSS            (1<<1)
  18 #define WLAN_CAPABILITY_CF_POLLABLE     (1<<2)
  19 #define WLAN_CAPABILITY_CF_POLL_REQUEST (1<<3)
  20 #define WLAN_CAPABILITY_PRIVACY         (1<<4)
  21 #define WLAN_CAPABILITY_SHORT_PREAMBLE  (1<<5)
  22 #define WLAN_CAPABILITY_PBCC            (1<<6)
  23 #define WLAN_CAPABILITY_CHANNEL_AGILITY (1<<7)
  24 #define WLAN_CAPABILITY_SPECTRUM_MGMT   (1<<8)
  25 #define WLAN_CAPABILITY_QOS             (1<<9)
  26 #define WLAN_CAPABILITY_SHORT_SLOT_TIME (1<<10)
  27 #define WLAN_CAPABILITY_APSD            (1<<11)
  28 #define WLAN_CAPABILITY_RADIO_MEASURE   (1<<12)
  29 #define WLAN_CAPABILITY_DSSS_OFDM       (1<<13)
  30 #define WLAN_CAPABILITY_DEL_BACK        (1<<14)
  31 #define WLAN_CAPABILITY_IMM_BACK        (1<<15)
  32 /* DMG (60gHz) 802.11ad */
  33 /* type - bits 0..1 */
  34 #define WLAN_CAPABILITY_DMG_TYPE_MASK           (3<<0)
  35
  36 #define WLAN_CAPABILITY_DMG_TYPE_IBSS           (1<<0) /* Tx by: STA */
  37 #define WLAN_CAPABILITY_DMG_TYPE_PBSS           (2<<0) /* Tx by: PCP */
  38 #define WLAN_CAPABILITY_DMG_TYPE_AP             (3<<0) /* Tx by: AP */
  39
  40 #define WLAN_CAPABILITY_DMG_CBAP_ONLY           (1<<2)
  41 #define WLAN_CAPABILITY_DMG_CBAP_SOURCE         (1<<3)
  42 #define WLAN_CAPABILITY_DMG_PRIVACY             (1<<4)
  43 #define WLAN_CAPABILITY_DMG_ECPAC               (1<<5)
  44
  45 #define WLAN_CAPABILITY_DMG_SPECTRUM_MGMT       (1<<8)
  46 #define WLAN_CAPABILITY_DMG_RADIO_MEASURE       (1<<12)
  47
  48 static unsigned char ms_oui[3]          = { 0x00, 0x50, 0xf2 };
  49 static unsigned char ieee80211_oui[3]   = { 0x00, 0x0f, 0xac };
  50 static unsigned char wfa_oui[3]         = { 0x50, 0x6f, 0x9a };
  51
  52 struct scan_params {
  53         bool unknown;
  54         enum print_ie_type type;
  55         bool show_both_ie_sets;
  56 };
  57
  58 #define IEEE80211_COUNTRY_EXTENSION_ID 201
  59
  60 union ieee80211_country_ie_triplet {
  61         struct {
  62                 __u8 first_channel;
  63                 __u8 num_channels;
  64                 __s8 max_power;
  65         } __attribute__ ((packed)) chans;
  66         struct {
  67                 __u8 reg_extension_id;
  68                 __u8 reg_class;
  69                 __u8 coverage_class;
  70         } __attribute__ ((packed)) ext;
  71 } __attribute__ ((packed));
  72
  73 static int handle_scan(struct nl80211_state *state,
  74                        struct nl_cb *cb,
  75                        struct nl_msg *msg,
  76                        int argc, char **argv,
  77                        enum id_input id)
  78 {
  79         struct nl_msg *ssids = NULL, *freqs = NULL;
  80         char *eptr;
  81         int err = -ENOBUFS;
  82         int i;
  83         enum {
  84                 NONE,
  85                 FREQ,
  86                 IES,
  87                 SSID,
  88                 MESHID,
  89                 DONE,
  90         } parse = NONE;
  91         int freq;
  92         bool passive = false, have_ssids = false, have_freqs = false;
  93         size_t ies_len = 0, meshid_len = 0;
  94         unsigned char *ies = NULL, *meshid = NULL, *tmpies;
  95         int flags = 0;
  96
  97         ssids = nlmsg_alloc();
  98         if (!ssids)
  99                 return -ENOMEM;
 100
 101         freqs = nlmsg_alloc();
 102         if (!freqs) {
 103                 nlmsg_free(ssids);
 104                 return -ENOMEM;
 105         }
 106
 107         for (i = 0; i < argc; i++) {
 108                 switch (parse) {
 109                 case NONE:
 110                         if (strcmp(argv[i], "freq") == 0) {
 111                                 parse = FREQ;
 112                                 have_freqs = true;
 113                                 break;
 114                         } else if (strcmp(argv[i], "ies") == 0) {
 115                                 parse = IES;
 116                                 break;
 117                         } else if (strcmp(argv[i], "lowpri") == 0) {
 118                                 parse = NONE;
 119                                 flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
 120                                 break;
 121                         } else if (strcmp(argv[i], "flush") == 0) {
 122                                 parse = NONE;
 123                                 flags |= NL80211_SCAN_FLAG_FLUSH;
 124                                 break;
 125                         } else if (strcmp(argv[i], "ap-force") == 0) {
 126                                 parse = NONE;
 127                                 flags |= NL80211_SCAN_FLAG_AP;
 128                                 break;
 129                         } else if (strcmp(argv[i], "ssid") == 0) {
 130                                 parse = SSID;
 131                                 have_ssids = true;
 132                                 break;
 133                         } else if (strcmp(argv[i], "passive") == 0) {
 134                                 parse = DONE;
 135                                 passive = true;
 136                                 break;
 137                         } else if (strcmp(argv[i], "meshid") == 0) {
 138                                 parse = MESHID;
 139                                 break;
 140                         }
 141                 case DONE:
 142                         return 1;
 143                 case FREQ:
 144                         freq = strtoul(argv[i], &eptr, 10);
 145                         if (eptr != argv[i] + strlen(argv[i])) {
 146                                 /* failed to parse as number -- maybe a tag? */
 147                                 i--;
 148                                 parse = NONE;
 149                                 continue;
 150                         }
 151                         NLA_PUT_U32(freqs, i, freq);
 152                         break;
 153                 case IES:
 154                         ies = parse_hex(argv[i], &ies_len);
 155                         if (!ies)
 156                                 goto nla_put_failure;
 157                         parse = NONE;
 158                         break;
 159                 case SSID:
 160                         NLA_PUT(ssids, i, strlen(argv[i]), argv[i]);
 161                         break;
 162                 case MESHID:
 163                         meshid_len = strlen(argv[i]);
 164                         meshid = (unsigned char *) malloc(meshid_len + 2);
 165                         if (!meshid)
 166                                 goto nla_put_failure;
 167                         meshid[0] = 114; /* mesh element id */
 168                         meshid[1] = meshid_len;
 169                         memcpy(&meshid[2], argv[i], meshid_len);
 170                         meshid_len += 2;
 171                         parse = NONE;
 172                         break;
 173                 }
 174         }
 175
 176         if (ies || meshid) {
 177                 tmpies = (unsigned char *) malloc(ies_len + meshid_len);
 178                 if (!tmpies)
 179                         goto nla_put_failure;
 180                 if (ies) {
 181                         memcpy(tmpies, ies, ies_len);
 182                         free(ies);
 183                 }
 184                 if (meshid) {
 185                         memcpy(&tmpies[ies_len], meshid, meshid_len);
 186                         free(meshid);
 187                 }
 188                 NLA_PUT(msg, NL80211_ATTR_IE, ies_len + meshid_len, tmpies);
 189                 free(tmpies);
 190         }
 191
 192         if (!have_ssids)
 193                 NLA_PUT(ssids, 1, 0, "");
 194         if (!passive)
 195                 nla_put_nested(msg, NL80211_ATTR_SCAN_SSIDS, ssids);
 196
 197         if (have_freqs)
 198                 nla_put_nested(msg, NL80211_ATTR_SCAN_FREQUENCIES, freqs);
 199         if (flags)
 200                 NLA_PUT_U32(msg, NL80211_ATTR_SCAN_FLAGS, flags);
 201
 202         err = 0;
 203  nla_put_failure:
 204         nlmsg_free(ssids);
 205         nlmsg_free(freqs);
 206         return err;
 207 }
 208
 209 static void tab_on_first(bool *first)
 210 {
 211         if (!*first)
 212                 printf("\t");
 213         else
 214                 *first = false;
 215 }
 216
 217 static void print_ssid(const uint8_t type, uint8_t len, const uint8_t *data)
 218 {
 219         printf(" ");
 220         print_ssid_escaped(len, data);
 221         printf("\n");
 222 }
 223
 224 #define BSS_MEMBERSHIP_SELECTOR_VHT_PHY 126
 225 #define BSS_MEMBERSHIP_SELECTOR_HT_PHY 127
 226
 227 static void print_supprates(const uint8_t type, uint8_t len, const uint8_t *data)
 228 {
 229         int i;
 230
 231         printf(" ");
 232
 233         for (i = 0; i < len; i++) {
 234                 int r = data[i] & 0x7f;
 235
 236                 if (r == BSS_MEMBERSHIP_SELECTOR_VHT_PHY && data[i] & 0x80)
 237                         printf("VHT");
 238                 else if (r == BSS_MEMBERSHIP_SELECTOR_HT_PHY && data[i] & 0x80)
 239                         printf("HT");
 240                 else
 241                         printf("%d.%d", r/2, 5*(r&1));
 242
 243                 printf("%s ", data[i] & 0x80 ? "*" : "");
 244         }
 245         printf("\n");
 246 }
 247
 248 static void print_ds(const uint8_t type, uint8_t len, const uint8_t *data)
 249 {
 250         printf(" channel %d\n", data[0]);
 251 }
 252
 253 static const char *country_env_str(char environment)
 254 {
 255         switch (environment) {
 256         case 'I':
 257                 return "Indoor only";
 258         case 'O':
 259                 return "Outdoor only";
 260         case ' ':
 261                 return "Indoor/Outdoor";
 262         default:
 263                 return "bogus";
 264         }
 265 }
 266
 267 static void print_country(const uint8_t type, uint8_t len, const uint8_t *data)
 268 {
 269         printf(" %.*s", 2, data);
 270
 271         printf("\tEnvironment: %s\n", country_env_str(data[2]));
 272
 273         data += 3;
 274         len -= 3;
 275
 276         if (len < 3) {
 277                 printf("\t\tNo country IE triplets present\n");
 278                 return;
 279         }
 280
 281         while (len >= 3) {
 282                 int end_channel;
 283                 union ieee80211_country_ie_triplet *triplet = (void *) data;
 284
 285                 if (triplet->ext.reg_extension_id >= IEEE80211_COUNTRY_EXTENSION_ID) {
 286                         printf("\t\tExtension ID: %d Regulatory Class: %d Coverage class: %d (up to %dm)\n",
 287                                triplet->ext.reg_extension_id,
 288                                triplet->ext.reg_class,
 289                                triplet->ext.coverage_class,
 290                                triplet->ext.coverage_class * 450);
 291
 292                         data += 3;
 293                         len -= 3;
 294                         continue;
 295                 }
 296
 297                 /* 2 GHz */
 298                 if (triplet->chans.first_channel <= 14)
 299                         end_channel = triplet->chans.first_channel + (triplet->chans.num_channels - 1);
 300                 else
 301                         end_channel =  triplet->chans.first_channel + (4 * (triplet->chans.num_channels - 1));
 302
 303                 printf("\t\tChannels [%d - %d] @ %d dBm\n", triplet->chans.first_channel, end_channel, triplet->chans.max_power);
 304
 305                 data += 3;
 306                 len -= 3;
 307         }
 308
 309         return;
 310 }
 311
 312 static void print_powerconstraint(const uint8_t type, uint8_t len, const uint8_t *data)
 313 {
 314         printf(" %d dB\n", data[0]);
 315 }
 316
 317 static void print_tpcreport(const uint8_t type, uint8_t len, const uint8_t *data)
 318 {
 319         printf(" TX power: %d dBm\n", data[0]);
 320         /* printf(" Link Margin (%d dB) is reserved in Beacons\n", data[1]); */
 321 }
 322
 323 static void print_erp(const uint8_t type, uint8_t len, const uint8_t *data)
 324 {
 325         if (data[0] == 0x00)
 326                 printf(" <no flags>");
 327         if (data[0] & 0x01)
 328                 printf(" NonERP_Present");
 329         if (data[0] & 0x02)
 330                 printf(" Use_Protection");
 331         if (data[0] & 0x04)
 332                 printf(" Barker_Preamble_Mode");
 333         printf("\n");
 334 }
 335
 336 static void print_cipher(const uint8_t *data)
 337 {
 338         if (memcmp(data, ms_oui, 3) == 0) {
 339                 switch (data[3]) {
 340                 case 0:
 341                         printf("Use group cipher suite");
 342                         break;
 343                 case 1:
 344                         printf("WEP-40");
 345                         break;
 346                 case 2:
 347                         printf("TKIP");
 348                         break;
 349                 case 4:
 350                         printf("CCMP");
 351                         break;
 352                 case 5:
 353                         printf("WEP-104");
 354                         break;
 355                 default:
 356                         printf("%.02x-%.02x-%.02x:%d",
 357                                 data[0], data[1] ,data[2], data[3]);
 358                         break;
 359                 }
 360         } else if (memcmp(data, ieee80211_oui, 3) == 0) {
 361                 switch (data[3]) {
 362                 case 0:
 363                         printf("Use group cipher suite");
 364                         break;
 365                 case 1:
 366                         printf("WEP-40");
 367                         break;
 368                 case 2:
 369                         printf("TKIP");
 370                         break;
 371                 case 4:
 372                         printf("CCMP");
 373                         break;
 374                 case 5:
 375                         printf("WEP-104");
 376                         break;
 377                 case 6:
 378                         printf("AES-128-CMAC");
 379                         break;
 380                 case 8:
 381                         printf("GCMP");
 382                         break;
 383                 default:
 384                         printf("%.02x-%.02x-%.02x:%d",
 385                                 data[0], data[1] ,data[2], data[3]);
 386                         break;
 387                 }
 388         } else
 389                 printf("%.02x-%.02x-%.02x:%d",
 390                         data[0], data[1] ,data[2], data[3]);
 391 }
 392
 393 static void print_auth(const uint8_t *data)
 394 {
 395         if (memcmp(data, ms_oui, 3) == 0) {
 396                 switch (data[3]) {
 397                 case 1:
 398                         printf("IEEE 802.1X");
 399                         break;
 400                 case 2:
 401                         printf("PSK");
 402                         break;
 403                 default:
 404                         printf("%.02x-%.02x-%.02x:%d",
 405                                 data[0], data[1] ,data[2], data[3]);
 406                         break;
 407                 }
 408         } else if (memcmp(data, ieee80211_oui, 3) == 0) {
 409                 switch (data[3]) {
 410                 case 1:
 411                         printf("IEEE 802.1X");
 412                         break;
 413                 case 2:
 414                         printf("PSK");
 415                         break;
 416                 case 3:
 417                         printf("FT/IEEE 802.1X");
 418                         break;
 419                 case 4:
 420                         printf("FT/PSK");
 421                         break;
 422                 case 5:
 423                         printf("IEEE 802.1X/SHA-256");
 424                         break;
 425                 case 6:
 426                         printf("PSK/SHA-256");
 427                         break;
 428                 case 7:
 429                         printf("TDLS/TPK");
 430                         break;
 431                 default:
 432                         printf("%.02x-%.02x-%.02x:%d",
 433                                 data[0], data[1] ,data[2], data[3]);
 434                         break;
 435                 }
 436         } else
 437                 printf("%.02x-%.02x-%.02x:%d",
 438                         data[0], data[1] ,data[2], data[3]);
 439 }
 440
 441 static void print_rsn_ie(const char *defcipher, const char *defauth,
 442                          uint8_t len, const uint8_t *data)
 443 {
 444         bool first = true;
 445         __u16 version, count, capa;
 446         int i;
 447
 448         version = data[0] + (data[1] << 8);
 449         tab_on_first(&first);
 450         printf("\t * Version: %d\n", version);
 451
 452         data += 2;
 453         len -= 2;
 454
 455         if (len < 4) {
 456                 tab_on_first(&first);
 457                 printf("\t * Group cipher: %s\n", defcipher);
 458                 printf("\t * Pairwise ciphers: %s\n", defcipher);
 459                 return;
 460         }
 461
 462         tab_on_first(&first);
 463         printf("\t * Group cipher: ");
 464         print_cipher(data);
 465         printf("\n");
 466
 467         data += 4;
 468         len -= 4;
 469
 470         if (len < 2) {
 471                 tab_on_first(&first);
 472                 printf("\t * Pairwise ciphers: %s\n", defcipher);
 473                 return;
 474         }
 475
 476         count = data[0] | (data[1] << 8);
 477         if (2 + (count * 4) > len)
 478                 goto invalid;
 479
 480         tab_on_first(&first);
 481         printf("\t * Pairwise ciphers:");
 482         for (i = 0; i < count; i++) {
 483                 printf(" ");
 484                 print_cipher(data + 2 + (i * 4));
 485         }
 486         printf("\n");
 487
 488         data += 2 + (count * 4);
 489         len -= 2 + (count * 4);
 490
 491         if (len < 2) {
 492                 tab_on_first(&first);
 493                 printf("\t * Authentication suites: %s\n", defauth);
 494                 return;
 495         }
 496
 497         count = data[0] | (data[1] << 8);
 498         if (2 + (count * 4) > len)
 499                 goto invalid;
 500
 501         tab_on_first(&first);
 502         printf("\t * Authentication suites:");
 503         for (i = 0; i < count; i++) {
 504                 printf(" ");
 505                 print_auth(data + 2 + (i * 4));
 506         }
 507         printf("\n");
 508
 509         data += 2 + (count * 4);
 510         len -= 2 + (count * 4);
 511
 512         if (len >= 2) {
 513                 capa = data[0] | (data[1] << 8);
 514                 tab_on_first(&first);
 515                 printf("\t * Capabilities:");
 516                 if (capa & 0x0001)
 517                         printf(" PreAuth");
 518                 if (capa & 0x0002)
 519                         printf(" NoPairwise");
 520                 switch ((capa & 0x000c) >> 2) {
 521                 case 0:
 522                         printf(" 1-PTKSA-RC");
 523                         break;
 524                 case 1:
 525                         printf(" 2-PTKSA-RC");
 526                         break;
 527                 case 2:
 528                         printf(" 4-PTKSA-RC");
 529                         break;
 530                 case 3:
 531                         printf(" 16-PTKSA-RC");
 532                         break;
 533                 }
 534                 switch ((capa & 0x0030) >> 4) {
 535                 case 0:
 536                         printf(" 1-GTKSA-RC");
 537                         break;
 538                 case 1:
 539                         printf(" 2-GTKSA-RC");
 540                         break;
 541                 case 2:
 542                         printf(" 4-GTKSA-RC");
 543                         break;
 544                 case 3:
 545                         printf(" 16-GTKSA-RC");
 546                         break;
 547                 }
 548                 if (capa & 0x0040)
 549                         printf(" MFP-required");
 550                 if (capa & 0x0080)
 551                         printf(" MFP-capable");
 552                 if (capa & 0x0200)
 553                         printf(" Peerkey-enabled");
 554                 if (capa & 0x0400)
 555                         printf(" SPP-AMSDU-capable");
 556                 if (capa & 0x0800)
 557                         printf(" SPP-AMSDU-required");
 558                 printf(" (0x%.4x)\n", capa);
 559                 data += 2;
 560                 len -= 2;
 561         }
 562
 563         if (len >= 2) {
 564                 int pmkid_count = data[0] | (data[1] << 8);
 565
 566                 if (len >= 2 + 16 * pmkid_count) {
 567                         tab_on_first(&first);
 568                         printf("\t * %d PMKIDs\n", pmkid_count);
 569                         /* not printing PMKID values */
 570                         data += 2 + 16 * pmkid_count;
 571                         len -= 2 + 16 * pmkid_count;
 572                 } else
 573                         goto invalid;
 574         }
 575
 576         if (len >= 4) {
 577                 tab_on_first(&first);
 578                 printf("\t * Group mgmt cipher suite: ");
 579                 print_cipher(data);
 580                 printf("\n");
 581                 data += 4;
 582                 len -= 4;
 583         }
 584
 585  invalid:
 586         if (len != 0) {
 587                 printf("\t\t * bogus tail data (%d):", len);
 588                 while (len) {
 589                         printf(" %.2x", *data);
 590                         data++;
 591                         len--;
 592                 }
 593                 printf("\n");
 594         }
 595 }
 596
 597 static void print_rsn(const uint8_t type, uint8_t len, const uint8_t *data)
 598 {
 599         print_rsn_ie("CCMP", "IEEE 802.1X", len, data);
 600 }
 601
 602 static void print_ht_capa(const uint8_t type, uint8_t len, const uint8_t *data)
 603 {
 604         printf("\n");
 605         print_ht_capability(data[0] | (data[1] << 8));
 606         print_ampdu_length(data[2] & 3);
 607         print_ampdu_spacing((data[2] >> 2) & 7);
 608         print_ht_mcs(data + 3);
 609 }
 610
 611 static const char* ntype_11u(uint8_t t)
 612 {
 613         switch (t) {
 614         case 0: return "Private";
 615         case 1: return "Private with Guest";
 616         case 2: return "Chargeable Public";
 617         case 3: return "Free Public";
 618         case 4: return "Personal Device";
 619         case 5: return "Emergency Services Only";
 620         case 14: return "Test or Experimental";
 621         case 15: return "Wildcard";
 622         default: return "Reserved";
 623         }
 624 }
 625
 626 static const char* vgroup_11u(uint8_t t)
 627 {
 628         switch (t) {
 629         case 0: return "Unspecified";
 630         case 1: return "Assembly";
 631         case 2: return "Business";
 632         case 3: return "Educational";
 633         case 4: return "Factory and Industrial";
 634         case 5: return "Institutional";
 635         case 6: return "Mercantile";
 636         case 7: return "Residential";
 637         case 8: return "Storage";
 638         case 9: return "Utility and Miscellaneous";
 639         case 10: return "Vehicular";
 640         case 11: return "Outdoor";
 641         default: return "Reserved";
 642         }
 643 }
 644
 645 static void print_interworking(const uint8_t type, uint8_t len, const uint8_t *data)
 646 {
 647         /* See Section 7.3.2.92 in the 802.11u spec. */
 648         printf("\n");
 649         if (len >= 1) {
 650                 uint8_t ano = data[0];
 651                 printf("\t\tNetwork Options: 0x%hx\n", (unsigned short)(ano));
 652                 printf("\t\t\tNetwork Type: %i (%s)\n",
 653                        (int)(ano & 0xf), ntype_11u(ano & 0xf));
 654                 if (ano & (1<<4))
 655                         printf("\t\t\tInternet\n");
 656                 if (ano & (1<<5))
 657                         printf("\t\t\tASRA\n");
 658                 if (ano & (1<<6))
 659                         printf("\t\t\tESR\n");
 660                 if (ano & (1<<7))
 661                         printf("\t\t\tUESA\n");
 662         }
 663         if ((len == 3) || (len == 9)) {
 664                 printf("\t\tVenue Group: %i (%s)\n",
 665                        (int)(data[1]), vgroup_11u(data[1]));
 666                 printf("\t\tVenue Type: %i\n", (int)(data[2]));
 667         }
 668         if (len == 9)
 669                 printf("\t\tHESSID: %02hx:%02hx:%02hx:%02hx:%02hx:%02hx\n",
 670                        data[3], data[4], data[5], data[6], data[7], data[8]);
 671         else if (len == 7)
 672                 printf("\t\tHESSID: %02hx:%02hx:%02hx:%02hx:%02hx:%02hx\n",
 673                        data[1], data[2], data[3], data[4], data[5], data[6]);
 674 }
 675
 676 static void print_11u_advert(const uint8_t type, uint8_t len, const uint8_t *data)
 677 {
 678         /* See Section 7.3.2.93 in the 802.11u spec. */
 679         /* TODO: This code below does not decode private protocol IDs */
 680         int idx = 0;
 681         printf("\n");
 682         while (idx < (len - 1)) {
 683                 uint8_t qri = data[idx];
 684                 uint8_t proto_id = data[idx + 1];
 685                 printf("\t\tQuery Response Info: 0x%hx\n", (unsigned short)(qri));
 686                 printf("\t\t\tQuery Response Length Limit: %i\n",
 687                        (qri & 0x7f));
 688                 if (qri & (1<<7))
 689                         printf("\t\t\tPAME-BI\n");
 690                 switch(proto_id) {
 691                 case 0:
 692                         printf("\t\t\tANQP\n"); break;
 693                 case 1:
 694                         printf("\t\t\tMIH Information Service\n"); break;
 695                 case 2:
 696                         printf("\t\t\tMIH Command and Event Services Capability Discovery\n"); break;
 697                 case 3:
 698                         printf("\t\t\tEmergency Alert System (EAS)\n"); break;
 699                 case 221:
 700                         printf("\t\t\tVendor Specific\n"); break;
 701                 default:
 702                         printf("\t\t\tReserved: %i\n", proto_id); break;
 703                 }
 704                 idx += 2;
 705         }
 706 }
 707
 708 static void print_11u_rcon(const uint8_t type, uint8_t len, const uint8_t *data)
 709 {
 710         /* See Section 7.3.2.96 in the 802.11u spec. */
 711         int idx = 0;
 712         int ln0 = data[1] & 0xf;
 713         int ln1 = ((data[1] & 0xf0) >> 4);
 714         int ln2 = 0;
 715         printf("\n");
 716
 717         if (ln1)
 718                 ln2 = len - 2 - ln0 - ln1;
 719
 720         printf("\t\tANQP OIs: %i\n", data[0]);
 721
 722         if (ln0 > 0) {
 723                 printf("\t\tOI 1: ");
 724                 if (2 + ln0 > len) {
 725                         printf("Invalid IE length.\n");
 726                 } else {
 727                         for (idx = 0; idx < ln0; idx++) {
 728                                 printf("%02hx", data[2 + idx]);
 729                         }
 730                         printf("\n");
 731                 }
 732         }
 733
 734         if (ln1 > 0) {
 735                 printf("\t\tOI 2: ");
 736                 if (2 + ln0 + ln1 > len) {
 737                         printf("Invalid IE length.\n");
 738                 } else {
 739                         for (idx = 0; idx < ln1; idx++) {
 740                                 printf("%02hx", data[2 + ln0 + idx]);
 741                         }
 742                         printf("\n");
 743                 }
 744         }
 745
 746         if (ln2 > 0) {
 747                 printf("\t\tOI 3: ");
 748                 if (2 + ln0 + ln1 + ln2 > len) {
 749                         printf("Invalid IE length.\n");
 750                 } else {
 751                         for (idx = 0; idx < ln2; idx++) {
 752                                 printf("%02hx", data[2 + ln0 + ln1 + idx]);
 753                         }
 754                         printf("\n");
 755                 }
 756         }
 757 }
 758
 759 static const char *ht_secondary_offset[4] = {
 760         "no secondary",
 761         "above",
 762         "[reserved!]",
 763         "below",
 764 };
 765
 766 static void print_ht_op(const uint8_t type, uint8_t len, const uint8_t *data)
 767 {
 768         static const char *protection[4] = {
 769                 "no",
 770                 "nonmember",
 771                 "20 MHz",
 772                 "non-HT mixed",
 773         };
 774         static const char *sta_chan_width[2] = {
 775                 "20 MHz",
 776                 "any",
 777         };
 778
 779         printf("\n");
 780         printf("\t\t * primary channel: %d\n", data[0]);
 781         printf("\t\t * secondary channel offset: %s\n",
 782                 ht_secondary_offset[data[1] & 0x3]);
 783         printf("\t\t * STA channel width: %s\n", sta_chan_width[(data[1] & 0x4)>>2]);
 784         printf("\t\t * RIFS: %d\n", (data[1] & 0x8)>>3);
 785         printf("\t\t * HT protection: %s\n", protection[data[2] & 0x3]);
 786         printf("\t\t * non-GF present: %d\n", (data[2] & 0x4) >> 2);
 787         printf("\t\t * OBSS non-GF present: %d\n", (data[2] & 0x10) >> 4);
 788         printf("\t\t * dual beacon: %d\n", (data[4] & 0x40) >> 6);
 789         printf("\t\t * dual CTS protection: %d\n", (data[4] & 0x80) >> 7);
 790         printf("\t\t * STBC beacon: %d\n", data[5] & 0x1);
 791         printf("\t\t * L-SIG TXOP Prot: %d\n", (data[5] & 0x2) >> 1);
 792         printf("\t\t * PCO active: %d\n", (data[5] & 0x4) >> 2);
 793         printf("\t\t * PCO phase: %d\n", (data[5] & 0x8) >> 3);
 794 }
 795
 796 static void print_capabilities(const uint8_t type, uint8_t len, const uint8_t *data)
 797 {
 798         int i, base, bit;
 799         bool first = true;
 800
 801
 802         for (i = 0; i < len; i++) {
 803                 base = i * 8;
 804
 805                 for (bit = 0; bit < 8; bit++) {
 806                         if (!(data[i] & (1 << bit)))
 807                                 continue;
 808
 809                         if (!first)
 810                                 printf(",");
 811                         else
 812                                 first = false;
 813
 814 #define CAPA(bit, name)         case bit: printf(" " name); break
 815
 816                         switch (bit + base) {
 817                         CAPA(0, "HT Information Exchange Supported");
 818                         CAPA(1, "reserved (On-demand Beacon)");
 819                         CAPA(2, "Extended Channel Switching");
 820                         CAPA(3, "reserved (Wave Indication)");
 821                         CAPA(4, "PSMP Capability");
 822                         CAPA(5, "reserved (Service Interval Granularity)");
 823                         CAPA(6, "S-PSMP Capability");
 824                         CAPA(7, "Event");
 825                         CAPA(8, "Diagnostics");
 826                         CAPA(9, "Multicast Diagnostics");
 827                         CAPA(10, "Location Tracking");
 828                         CAPA(11, "FMS");
 829                         CAPA(12, "Proxy ARP Service");
 830                         CAPA(13, "Collocated Interference Reporting");
 831                         CAPA(14, "Civic Location");
 832                         CAPA(15, "Geospatial Location");
 833                         CAPA(16, "TFS");
 834                         CAPA(17, "WNM-Sleep Mode");
 835                         CAPA(18, "TIM Broadcast");
 836                         CAPA(19, "BSS Transition");
 837                         CAPA(20, "QoS Traffic Capability");
 838                         CAPA(21, "AC Station Count");
 839                         CAPA(22, "Multiple BSSID");
 840                         CAPA(23, "Timing Measurement");
 841                         CAPA(24, "Channel Usage");
 842                         CAPA(25, "SSID List");
 843                         CAPA(26, "DMS");
 844                         CAPA(27, "UTC TSF Offset");
 845                         CAPA(28, "TDLS Peer U-APSD Buffer STA Support");
 846                         CAPA(29, "TDLS Peer PSM Support");
 847                         CAPA(30, "TDLS channel switching");
 848                         CAPA(31, "Interworking");
 849                         CAPA(32, "QoS Map");
 850                         CAPA(33, "EBR");
 851                         CAPA(34, "SSPN Interface");
 852                         CAPA(35, "Reserved");
 853                         CAPA(36, "MSGCF Capability");
 854                         CAPA(37, "TDLS Support");
 855                         CAPA(38, "TDLS Prohibited");
 856                         CAPA(39, "TDLS Channel Switching Prohibited");
 857                         CAPA(40, "Reject Unadmitted Frame");
 858                         CAPA(44, "Identifier Location");
 859                         CAPA(45, "U-APSD Coexistence");
 860                         CAPA(46, "WNM-Notification");
 861                         CAPA(47, "Reserved");
 862                         CAPA(48, "UTF-8 SSID");
 863                         default:
 864                                 printf(" %d", bit);
 865                                 break;
 866                         }
 867 #undef CAPA
 868                 }
 869         }
 870
 871         printf("\n");
 872 }
 873
 874 static void print_tim(const uint8_t type, uint8_t len, const uint8_t *data)
 875 {
 876         printf(" DTIM Count %u DTIM Period %u Bitmap Control 0x%x "
 877                "Bitmap[0] 0x%x",
 878                data[0], data[1], data[2], data[3]);
 879         if (len - 4)
 880                 printf(" (+ %u octet%s)", len - 4, len - 4 == 1 ? "" : "s");
 881         printf("\n");
 882 }
 883
 884 static void print_ibssatim(const uint8_t type, uint8_t len, const uint8_t *data)
 885 {
 886         printf(" %d TUs", (data[1] << 8) + data[0]);
 887 }
 888
 889 static void print_vht_capa(const uint8_t type, uint8_t len, const uint8_t *data)
 890 {
 891         printf("\n");
 892         print_vht_info(data[0] | (data[1] << 8) |
 893                        (data[2] << 16) | (data[3] << 24),
 894                        data + 4);
 895 }
 896
 897 static void print_vht_oper(const uint8_t type, uint8_t len, const uint8_t *data)
 898 {
 899         const char *chandwidths[] = {
 900                 [0] = "20 or 40 MHz",
 901                 [1] = "80 MHz",
 902                 [3] = "80+80 MHz",
 903                 [2] = "160 MHz",
 904         };
 905
 906         printf("\n");
 907         printf("\t\t * channel width: %d (%s)\n", data[0],
 908                 data[0] < ARRAY_SIZE(chandwidths) ? chandwidths[data[0]] : "unknown");
 909         printf("\t\t * center freq segment 1: %d\n", data[1]);
 910         printf("\t\t * center freq segment 2: %d\n", data[2]);
 911         printf("\t\t * VHT basic MCS set: 0x%.2x%.2x\n", data[4], data[3]);
 912 }
 913
 914 static void print_obss_scan_params(const uint8_t type, uint8_t len, const uint8_t *data)
 915 {
 916         printf("\n");
 917         printf("\t\t * passive dwell: %d TUs\n", (data[1] << 8) | data[0]);
 918         printf("\t\t * active dwell: %d TUs\n", (data[3] << 8) | data[2]);
 919         printf("\t\t * channel width trigger scan interval: %d s\n", (data[5] << 8) | data[4]);
 920         printf("\t\t * scan passive total per channel: %d TUs\n", (data[7] << 8) | data[6]);
 921         printf("\t\t * scan active total per channel: %d TUs\n", (data[9] << 8) | data[8]);
 922         printf("\t\t * BSS width channel transition delay factor: %d\n", (data[11] << 8) | data[10]);
 923         printf("\t\t * OBSS Scan Activity Threshold: %d.%02d %%\n",
 924                 ((data[13] << 8) | data[12]) / 100, ((data[13] << 8) | data[12]) % 100);
 925 }
 926
 927 static void print_secchan_offs(const uint8_t type, uint8_t len, const uint8_t *data)
 928 {
 929         if (data[0] < ARRAY_SIZE(ht_secondary_offset))
 930                 printf(" %s (%d)\n", ht_secondary_offset[data[0]], data[0]);
 931         else
 932                 printf(" %d\n", data[0]);
 933 }
 934
 935 static void print_bss_load(const uint8_t type, uint8_t len, const uint8_t *data)
 936 {
 937         printf("\n");
 938         printf("\t\t * station count: %d\n", (data[1] << 8) | data[0]);
 939         printf("\t\t * channel utilisation: %d/255\n", data[2]);
 940         printf("\t\t * available admission capacity: %d [*32us]\n", (data[4] << 8) | data[3]);
 941 }
 942
 943 static void print_mesh_conf(const uint8_t type, uint8_t len, const uint8_t *data)
 944 {
 945         printf("\n");
 946         printf("\t\t * Active Path Selection Protocol ID: %d\n", data[0]);
 947         printf("\t\t * Active Path Selection Metric ID: %d\n", data[1]);
 948         printf("\t\t * Congestion Control Mode ID: %d\n", data[2]);
 949         printf("\t\t * Synchronization Method ID: %d\n", data[3]);
 950         printf("\t\t * Authentication Protocol ID: %d\n", data[4]);
 951         printf("\t\t * Mesh Formation Info:\n");
 952         printf("\t\t\t Number of Peerings: %d\n", (data[5] & 0x7E) >> 1);
 953         if (data[5] & 0x01)
 954                 printf("\t\t\t Connected to Mesh Gate\n");
 955         if (data[5] & 0x80)
 956                 printf("\t\t\t Connected to AS\n");
 957         printf("\t\t * Mesh Capability\n");
 958         if (data[6] & 0x01)
 959                 printf("\t\t\t Accepting Additional Mesh Peerings\n");
 960         if (data[6] & 0x02)
 961                 printf("\t\t\t MCCA Supported\n");
 962         if (data[6] & 0x04)
 963                 printf("\t\t\t MCCA Enabled\n");
 964         if (data[6] & 0x08)
 965                 printf("\t\t\t Forwarding\n");
 966         if (data[6] & 0x10)
 967                 printf("\t\t\t MBCA Supported\n");
 968         if (data[6] & 0x20)
 969                 printf("\t\t\t TBTT Adjusting\n");
 970         if (data[6] & 0x40)
 971                 printf("\t\t\t Mesh Power Save Level\n");
 972 }
 973
 974 struct ie_print {
 975         const char *name;
 976         void (*print)(const uint8_t type, uint8_t len, const uint8_t *data);
 977         uint8_t minlen, maxlen;
 978         uint8_t flags;
 979 };
 980
 981 static void print_ie(const struct ie_print *p, const uint8_t type,
 982                      uint8_t len, const uint8_t *data)
 983 {
 984         int i;
 985
 986         if (!p->print)
 987                 return;
 988
 989         printf("\t%s:", p->name);
 990         if (len < p->minlen || len > p->maxlen) {
 991                 if (len > 1) {
 992                         printf(" <invalid: %d bytes:", len);
 993                         for (i = 0; i < len; i++)
 994                                 printf(" %.02x", data[i]);
 995                         printf(">\n");
 996                 } else if (len)
 997                         printf(" <invalid: 1 byte: %.02x>\n", data[0]);
 998                 else
 999                         printf(" <invalid: no data>\n");
1000                 return;
1001         }
1002
1003         p->print(type, len, data);
1004 }
1005
1006 #define PRINT_IGN {             \
1007         .name = "IGNORE",       \
1008         .print = NULL,          \
1009         .minlen = 0,            \
1010         .maxlen = 255,          \
1011 }
1012
1013 static const struct ie_print ieprinters[] = {
1014         [0] = { "SSID", print_ssid, 0, 32, BIT(PRINT_SCAN) | BIT(PRINT_LINK), },
1015         [1] = { "Supported rates", print_supprates, 0, 255, BIT(PRINT_SCAN), },
1016         [3] = { "DS Parameter set", print_ds, 1, 1, BIT(PRINT_SCAN), },
1017         [5] = { "TIM", print_tim, 4, 255, BIT(PRINT_SCAN), },
1018         [6] = { "IBSS ATIM window", print_ibssatim, 2, 2, BIT(PRINT_SCAN), },
1019         [7] = { "Country", print_country, 3, 255, BIT(PRINT_SCAN), },
1020         [11] = { "BSS Load", print_bss_load, 5, 5, BIT(PRINT_SCAN), },
1021         [32] = { "Power constraint", print_powerconstraint, 1, 1, BIT(PRINT_SCAN), },
1022         [35] = { "TPC report", print_tpcreport, 2, 2, BIT(PRINT_SCAN), },
1023         [42] = { "ERP", print_erp, 1, 255, BIT(PRINT_SCAN), },
1024         [45] = { "HT capabilities", print_ht_capa, 26, 26, BIT(PRINT_SCAN), },
1025         [47] = { "ERP D4.0", print_erp, 1, 255, BIT(PRINT_SCAN), },
1026         [74] = { "Overlapping BSS scan params", print_obss_scan_params, 14, 255, BIT(PRINT_SCAN), },
1027         [61] = { "HT operation", print_ht_op, 22, 22, BIT(PRINT_SCAN), },
1028         [62] = { "Secondary Channel Offset", print_secchan_offs, 1, 1, BIT(PRINT_SCAN), },
1029         [191] = { "VHT capabilities", print_vht_capa, 12, 255, BIT(PRINT_SCAN), },
1030         [192] = { "VHT operation", print_vht_oper, 5, 255, BIT(PRINT_SCAN), },
1031         [48] = { "RSN", print_rsn, 2, 255, BIT(PRINT_SCAN), },
1032         [50] = { "Extended supported rates", print_supprates, 0, 255, BIT(PRINT_SCAN), },
1033         [113] = { "MESH Configuration", print_mesh_conf, 7, 7, BIT(PRINT_SCAN), },
1034         [114] = { "MESH ID", print_ssid, 0, 32, BIT(PRINT_SCAN) | BIT(PRINT_LINK), },
1035         [127] = { "Extended capabilities", print_capabilities, 0, 255, BIT(PRINT_SCAN), },
1036         [107] = { "802.11u Interworking", print_interworking, 0, 255, BIT(PRINT_SCAN), },
1037         [108] = { "802.11u Advertisement", print_11u_advert, 0, 255, BIT(PRINT_SCAN), },
1038         [111] = { "802.11u Roaming Consortium", print_11u_rcon, 0, 255, BIT(PRINT_SCAN), },
1039 };
1040
1041 static void print_wifi_wpa(const uint8_t type, uint8_t len, const uint8_t *data)
1042 {
1043         print_rsn_ie("TKIP", "IEEE 802.1X", len, data);
1044 }
1045
1046 static bool print_wifi_wmm_param(const uint8_t *data, uint8_t len)
1047 {
1048         int i;
1049         static const char *aci_tbl[] = { "BE", "BK", "VI", "VO" };
1050
1051         if (len < 19)
1052                 goto invalid;
1053
1054         if (data[0] != 1) {
1055                 printf("Parameter: not version 1: ");
1056                 return false;
1057         }
1058
1059         printf("\t * Parameter version 1");
1060
1061         data++;
1062
1063         if (data[0] & 0x80)
1064                 printf("\n\t\t * u-APSD");
1065
1066         data += 2;
1067
1068         for (i = 0; i < 4; i++) {
1069                 printf("\n\t\t * %s:", aci_tbl[(data[0] >> 5) & 3]);
1070                 if (data[0] & 0x10)
1071                         printf(" acm");
1072                 printf(" CW %d-%d", (1 << (data[1] & 0xf)) - 1,
1073                                     (1 << (data[1] >> 4)) - 1);
1074                 printf(", AIFSN %d", data[0] & 0xf);
1075                 if (data[2] | data[3])
1076                         printf(", TXOP %d usec", (data[2] + (data[3] << 8)) * 32);
1077                 data += 4;
1078         }
1079
1080         printf("\n");
1081         return true;
1082
1083  invalid:
1084         printf("invalid: ");
1085         return false;
1086 }
1087
1088 static void print_wifi_wmm(const uint8_t type, uint8_t len, const uint8_t *data)
1089 {
1090         int i;
1091
1092         switch (data[0]) {
1093         case 0x00:
1094                 printf(" information:");
1095                 break;
1096         case 0x01:
1097                 if (print_wifi_wmm_param(data + 1, len - 1))
1098                         return;
1099                 break;
1100         default:
1101                 printf(" type %d:", data[0]);
1102                 break;
1103         }
1104
1105         for(i = 1; i < len; i++)
1106                 printf(" %.02x", data[i]);
1107         printf("\n");
1108 }
1109
1110 static const char * wifi_wps_dev_passwd_id(uint16_t id)
1111 {
1112         switch (id) {
1113         case 0:
1114                 return "Default (PIN)";
1115         case 1:
1116                 return "User-specified";
1117         case 2:
1118                 return "Machine-specified";
1119         case 3:
1120                 return "Rekey";
1121         case 4:
1122                 return "PushButton";
1123         case 5:
1124                 return "Registrar-specified";
1125         default:
1126                 return "??";
1127         }
1128 }
1129
1130 static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data)
1131 {
1132         bool first = true;
1133         __u16 subtype, sublen;
1134
1135         while (len >= 4) {
1136                 subtype = (data[0] << 8) + data[1];
1137                 sublen = (data[2] << 8) + data[3];
1138                 if (sublen > len)
1139                         break;
1140
1141                 switch (subtype) {
1142                 case 0x104a:
1143                         tab_on_first(&first);
1144                         printf("\t * Version: %d.%d\n", data[4] >> 4, data[4] & 0xF);
1145                         break;
1146                 case 0x1011:
1147                         tab_on_first(&first);
1148                         printf("\t * Device name: %.*s\n", sublen, data + 4);
1149                         break;
1150                 case 0x1012: {
1151                         uint16_t id;
1152                         tab_on_first(&first);
1153                         if (sublen != 2) {
1154                                 printf("\t * Device Password ID: (invalid "
1155                                        "length %d)\n", sublen);
1156                                 break;
1157                         }
1158                         id = data[4] << 8 | data[5];
1159                         printf("\t * Device Password ID: %u (%s)\n",
1160                                id, wifi_wps_dev_passwd_id(id));
1161                         break;
1162                 }
1163                 case 0x1021:
1164                         tab_on_first(&first);
1165                         printf("\t * Manufacturer: %.*s\n", sublen, data + 4);
1166                         break;
1167                 case 0x1023:
1168                         tab_on_first(&first);
1169                         printf("\t * Model: %.*s\n", sublen, data + 4);
1170                         break;
1171                 case 0x1024:
1172                         tab_on_first(&first);
1173                         printf("\t * Model Number: %.*s\n", sublen, data + 4);
1174                         break;
1175                 case 0x103b: {
1176                         __u8 val = data[4];
1177                         tab_on_first(&first);
1178                         printf("\t * Response Type: %d%s\n",
1179                                val, val == 3 ? " (AP)" : "");
1180                         break;
1181                 }
1182                 case 0x103c: {
1183                         __u8 val = data[4];
1184                         tab_on_first(&first);
1185                         printf("\t * RF Bands: 0x%x\n", val);
1186                         break;
1187                 }
1188                 case 0x1041: {
1189                         __u8 val = data[4];
1190                         tab_on_first(&first);
1191                         printf("\t * Selected Registrar: 0x%x\n", val);
1192                         break;
1193                 }
1194                 case 0x1042:
1195                         tab_on_first(&first);
1196                         printf("\t * Serial Number: %.*s\n", sublen, data + 4);
1197                         break;
1198                 case 0x1044: {
1199                         __u8 val = data[4];
1200                         tab_on_first(&first);
1201                         printf("\t * Wi-Fi Protected Setup State: %d%s%s\n",
1202                                val,
1203                                val == 1 ? " (Unconfigured)" : "",
1204                                val == 2 ? " (Configured)" : "");
1205                         break;
1206                 }
1207                 case 0x1047:
1208                         tab_on_first(&first);
1209                         printf("\t * UUID: ");
1210                         if (sublen != 16) {
1211                                 printf("(invalid, length=%d)\n", sublen);
1212                                 break;
1213                         }
1214                         printf("%02x%02x%02x%02x-%02x%02x-%02x%02x-"
1215                                 "%02x%02x-%02x%02x%02x%02x%02x%02x\n",
1216                                 data[4], data[5], data[6], data[7],
1217                                 data[8], data[9], data[10], data[11],
1218                                 data[12], data[13], data[14], data[15],
1219                                 data[16], data[17], data[18], data[19]);
1220                         break;
1221                 case 0x1054: {
1222                         tab_on_first(&first);
1223                         if (sublen != 8) {
1224                                 printf("\t * Primary Device Type: (invalid "
1225                                        "length %d)\n", sublen);
1226                                 break;
1227                         }
1228                         printf("\t * Primary Device Type: "
1229                                "%u-%02x%02x%02x%02x-%u\n",
1230                                data[4] << 8 | data[5],
1231                                data[6], data[7], data[8], data[9],
1232                                data[10] << 8 | data[11]);
1233                         break;
1234                 }
1235                 case 0x1057: {
1236                         __u8 val = data[4];
1237                         tab_on_first(&first);
1238                         printf("\t * AP setup locked: 0x%.2x\n", val);
1239                         break;
1240                 }
1241                 case 0x1008:
1242                 case 0x1053: {
1243                         __u16 meth = (data[4] << 8) + data[5];
1244                         bool comma = false;
1245                         tab_on_first(&first);
1246                         printf("\t * %sConfig methods:",
1247                                subtype == 0x1053 ? "Selected Registrar ": "");
1248 #define T(bit, name) do {               \
1249         if (meth & (1<<bit)) {          \
1250                 if (comma)              \
1251                         printf(",");    \
1252                 comma = true;           \
1253                 printf(" " name);       \
1254         } } while (0)
1255                         T(0, "USB");
1256                         T(1, "Ethernet");
1257                         T(2, "Label");
1258                         T(3, "Display");
1259                         T(4, "Ext. NFC");
1260                         T(5, "Int. NFC");
1261                         T(6, "NFC Intf.");
1262                         T(7, "PBC");
1263                         T(8, "Keypad");
1264                         printf("\n");
1265                         break;
1266 #undef T
1267                 }
1268                 default: {
1269                         const __u8 *subdata = data + 4;
1270                         __u16 tmplen = sublen;
1271
1272                         tab_on_first(&first);
1273                         printf("\t * Unknown TLV (%#.4x, %d bytes):",
1274                                subtype, tmplen);
1275                         while (tmplen) {
1276                                 printf(" %.2x", *subdata);
1277                                 subdata++;
1278                                 tmplen--;
1279                         }
1280                         printf("\n");
1281                         break;
1282                 }
1283                 }
1284
1285                 data += sublen + 4;
1286                 len -= sublen + 4;
1287         }
1288
1289         if (len != 0) {
1290                 printf("\t\t * bogus tail data (%d):", len);
1291                 while (len) {
1292                         printf(" %.2x", *data);
1293                         data++;
1294                         len--;
1295                 }
1296                 printf("\n");
1297         }
1298 }
1299
1300 static const struct ie_print wifiprinters[] = {
1301         [1] = { "WPA", print_wifi_wpa, 2, 255, BIT(PRINT_SCAN), },
1302         [2] = { "WMM", print_wifi_wmm, 1, 255, BIT(PRINT_SCAN), },
1303         [4] = { "WPS", print_wifi_wps, 0, 255, BIT(PRINT_SCAN), },
1304 };
1305
1306 static inline void print_p2p(const uint8_t type, uint8_t len, const uint8_t *data)
1307 {
1308         bool first = true;
1309         __u8 subtype;
1310         __u16 sublen;
1311
1312         while (len >= 3) {
1313                 subtype = data[0];
1314                 sublen = (data[2] << 8) + data[1];
1315
1316                 if (sublen > len - 3)
1317                         break;
1318
1319                 switch (subtype) {
1320                 case 0x02: /* capability */
1321                         tab_on_first(&first);
1322                         if (sublen < 2) {
1323                                 printf("\t * malformed capability\n");
1324                                 break;
1325                         }
1326                         printf("\t * Group capa: 0x%.2x, Device capa: 0x%.2x\n",
1327                                 data[3], data[4]);
1328                         break;
1329                 case 0x0d: /* device info */
1330                         if (sublen < 6 + 2 + 8 + 1) {
1331                                 printf("\t * malformed device info\n");
1332                                 break;
1333                         }
1334                         /* fall through for now */
1335                 case 0x00: /* status */
1336                 case 0x01: /* minor reason */
1337                 case 0x03: /* device ID */
1338                 case 0x04: /* GO intent */
1339                 case 0x05: /* configuration timeout */
1340                 case 0x06: /* listen channel */
1341                 case 0x07: /* group BSSID */
1342                 case 0x08: /* ext listen timing */
1343                 case 0x09: /* intended interface address */
1344                 case 0x0a: /* manageability */
1345                 case 0x0b: /* channel list */
1346                 case 0x0c: /* NoA */
1347                 case 0x0e: /* group info */
1348                 case 0x0f: /* group ID */
1349                 case 0x10: /* interface */
1350                 case 0x11: /* operating channel */
1351                 case 0x12: /* invitation flags */
1352                 case 0xdd: /* vendor specific */
1353                 default: {
1354                         const __u8 *subdata = data + 4;
1355                         __u16 tmplen = sublen;
1356
1357                         tab_on_first(&first);
1358                         printf("\t * Unknown TLV (%#.2x, %d bytes):",
1359                                subtype, tmplen);
1360                         while (tmplen) {
1361                                 printf(" %.2x", *subdata);
1362                                 subdata++;
1363                                 tmplen--;
1364                         }
1365                         printf("\n");
1366                         break;
1367                 }
1368                 }
1369
1370                 data += sublen + 3;
1371                 len -= sublen + 3;
1372         }
1373
1374         if (len != 0) {
1375                 tab_on_first(&first);
1376                 printf("\t * bogus tail data (%d):", len);
1377                 while (len) {
1378                         printf(" %.2x", *data);
1379                         data++;
1380                         len--;
1381                 }
1382                 printf("\n");
1383         }
1384 }
1385
1386 static inline void print_hs20_ind(const uint8_t type, uint8_t len, const uint8_t *data)
1387 {
1388         /* I can't find the spec for this...just going off what wireshark uses. */
1389         printf("\n");
1390         if (len > 0)
1391                 printf("\t\tDGAF: %i\n", (int)(data[0] & 0x1));
1392         else
1393                 printf("\t\tUnexpected length: %i\n", len);
1394 }
1395
1396 static const struct ie_print wfa_printers[] = {
1397         [9] = { "P2P", print_p2p, 2, 255, BIT(PRINT_SCAN), },
1398         [16] = { "HotSpot 2.0 Indication", print_hs20_ind, 1, 255, BIT(PRINT_SCAN), },
1399 };
1400
1401 static void print_vendor(unsigned char len, unsigned char *data,
1402                          bool unknown, enum print_ie_type ptype)
1403 {
1404         int i;
1405
1406         if (len < 3) {
1407                 printf("\tVendor specific: <too short> data:");
1408                 for(i = 0; i < len; i++)
1409                         printf(" %.02x", data[i]);
1410                 printf("\n");
1411                 return;
1412         }
1413
1414         if (len >= 4 && memcmp(data, ms_oui, 3) == 0) {
1415                 if (data[3] < ARRAY_SIZE(wifiprinters) &&
1416                     wifiprinters[data[3]].name &&
1417                     wifiprinters[data[3]].flags & BIT(ptype)) {
1418                         print_ie(&wifiprinters[data[3]], data[3], len - 4, data + 4);
1419                         return;
1420                 }
1421                 if (!unknown)
1422                         return;
1423                 printf("\tMS/WiFi %#.2x, data:", data[3]);
1424                 for(i = 0; i < len - 4; i++)
1425                         printf(" %.02x", data[i + 4]);
1426                 printf("\n");
1427                 return;
1428         }
1429
1430         if (len >= 4 && memcmp(data, wfa_oui, 3) == 0) {
1431                 if (data[3] < ARRAY_SIZE(wfa_printers) &&
1432                     wfa_printers[data[3]].name &&
1433                     wfa_printers[data[3]].flags & BIT(ptype)) {
1434                         print_ie(&wfa_printers[data[3]], data[3], len - 4, data + 4);
1435                         return;
1436                 }
1437                 if (!unknown)
1438                         return;
1439                 printf("\tWFA %#.2x, data:", data[3]);
1440                 for(i = 0; i < len - 4; i++)
1441                         printf(" %.02x", data[i + 4]);
1442                 printf("\n");
1443                 return;
1444         }
1445
1446         if (!unknown)
1447                 return;
1448
1449         printf("\tVendor specific: OUI %.2x:%.2x:%.2x, data:",
1450                 data[0], data[1], data[2]);
1451         for (i = 3; i < len; i++)
1452                 printf(" %.2x", data[i]);
1453         printf("\n");
1454 }
1455
1456 void print_ies(unsigned char *ie, int ielen, bool unknown,
1457                enum print_ie_type ptype)
1458 {
1459         while (ielen >= 2 && ielen >= ie[1]) {
1460                 if (ie[0] < ARRAY_SIZE(ieprinters) &&
1461                     ieprinters[ie[0]].name &&
1462                     ieprinters[ie[0]].flags & BIT(ptype)) {
1463                         print_ie(&ieprinters[ie[0]], ie[0], ie[1], ie + 2);
1464                 } else if (ie[0] == 221 /* vendor */) {
1465                         print_vendor(ie[1], ie + 2, unknown, ptype);
1466                 } else if (unknown) {
1467                         int i;
1468
1469                         printf("\tUnknown IE (%d):", ie[0]);
1470                         for (i=0; i<ie[1]; i++)
1471                                 printf(" %.2x", ie[2+i]);
1472                         printf("\n");
1473                 }
1474                 ielen -= ie[1] + 2;
1475                 ie += ie[1] + 2;
1476         }
1477 }
1478
1479 static void print_capa_dmg(__u16 capa)
1480 {
1481         switch (capa & WLAN_CAPABILITY_DMG_TYPE_MASK) {
1482         case WLAN_CAPABILITY_DMG_TYPE_AP:
1483                 printf(" DMG_ESS");
1484                 break;
1485         case WLAN_CAPABILITY_DMG_TYPE_PBSS:
1486                 printf(" DMG_PCP");
1487                 break;
1488         case WLAN_CAPABILITY_DMG_TYPE_IBSS:
1489                 printf(" DMG_IBSS");
1490                 break;
1491         }
1492
1493         if (capa & WLAN_CAPABILITY_DMG_CBAP_ONLY)
1494                 printf(" CBAP_Only");
1495         if (capa & WLAN_CAPABILITY_DMG_CBAP_SOURCE)
1496                 printf(" CBAP_Src");
1497         if (capa & WLAN_CAPABILITY_DMG_PRIVACY)
1498                 printf(" Privacy");
1499         if (capa & WLAN_CAPABILITY_DMG_ECPAC)
1500                 printf(" ECPAC");
1501         if (capa & WLAN_CAPABILITY_DMG_SPECTRUM_MGMT)
1502                 printf(" SpectrumMgmt");
1503         if (capa & WLAN_CAPABILITY_DMG_RADIO_MEASURE)
1504                 printf(" RadioMeasure");
1505 }
1506
1507 static void print_capa_non_dmg(__u16 capa)
1508 {
1509         if (capa & WLAN_CAPABILITY_ESS)
1510                 printf(" ESS");
1511         if (capa & WLAN_CAPABILITY_IBSS)
1512                 printf(" IBSS");
1513         if (capa & WLAN_CAPABILITY_CF_POLLABLE)
1514                 printf(" CfPollable");
1515         if (capa & WLAN_CAPABILITY_CF_POLL_REQUEST)
1516                 printf(" CfPollReq");
1517         if (capa & WLAN_CAPABILITY_PRIVACY)
1518                 printf(" Privacy");
1519         if (capa & WLAN_CAPABILITY_SHORT_PREAMBLE)
1520                 printf(" ShortPreamble");
1521         if (capa & WLAN_CAPABILITY_PBCC)
1522                 printf(" PBCC");
1523         if (capa & WLAN_CAPABILITY_CHANNEL_AGILITY)
1524                 printf(" ChannelAgility");
1525         if (capa & WLAN_CAPABILITY_SPECTRUM_MGMT)
1526                 printf(" SpectrumMgmt");
1527         if (capa & WLAN_CAPABILITY_QOS)
1528                 printf(" QoS");
1529         if (capa & WLAN_CAPABILITY_SHORT_SLOT_TIME)
1530                 printf(" ShortSlotTime");
1531         if (capa & WLAN_CAPABILITY_APSD)
1532                 printf(" APSD");
1533         if (capa & WLAN_CAPABILITY_RADIO_MEASURE)
1534                 printf(" RadioMeasure");
1535         if (capa & WLAN_CAPABILITY_DSSS_OFDM)
1536                 printf(" DSSS-OFDM");
1537         if (capa & WLAN_CAPABILITY_DEL_BACK)
1538                 printf(" DelayedBACK");
1539         if (capa & WLAN_CAPABILITY_IMM_BACK)
1540                 printf(" ImmediateBACK");
1541 }
1542
1543 static int print_bss_handler(struct nl_msg *msg, void *arg)
1544 {
1545         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1546         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1547         struct nlattr *bss[NL80211_BSS_MAX + 1];
1548         char mac_addr[20], dev[20];
1549         static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
1550                 [NL80211_BSS_TSF] = { .type = NLA_U64 },
1551                 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
1552                 [NL80211_BSS_BSSID] = { },
1553                 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
1554                 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
1555                 [NL80211_BSS_INFORMATION_ELEMENTS] = { },
1556                 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
1557                 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
1558                 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
1559                 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
1560                 [NL80211_BSS_BEACON_IES] = { },
1561         };
1562         struct scan_params *params = arg;
1563         int show = params->show_both_ie_sets ? 2 : 1;
1564         bool is_dmg = false;
1565
1566         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1567                   genlmsg_attrlen(gnlh, 0), NULL);
1568
1569         if (!tb[NL80211_ATTR_BSS]) {
1570                 fprintf(stderr, "bss info missing!\n");
1571                 return NL_SKIP;
1572         }
1573         if (nla_parse_nested(bss, NL80211_BSS_MAX,
1574                              tb[NL80211_ATTR_BSS],
1575                              bss_policy)) {
1576                 fprintf(stderr, "failed to parse nested attributes!\n");
1577                 return NL_SKIP;
1578         }
1579
1580         if (!bss[NL80211_BSS_BSSID])
1581                 return NL_SKIP;
1582
1583         mac_addr_n2a(mac_addr, nla_data(bss[NL80211_BSS_BSSID]));
1584         printf("BSS %s", mac_addr);
1585         if (tb[NL80211_ATTR_IFINDEX]) {
1586                 if_indextoname(nla_get_u32(tb[NL80211_ATTR_IFINDEX]), dev);
1587                 printf("(on %s)", dev);
1588         }
1589
1590         if (bss[NL80211_BSS_STATUS]) {
1591                 switch (nla_get_u32(bss[NL80211_BSS_STATUS])) {
1592                 case NL80211_BSS_STATUS_AUTHENTICATED:
1593                         printf(" -- authenticated");
1594                         break;
1595                 case NL80211_BSS_STATUS_ASSOCIATED:
1596                         printf(" -- associated");
1597                         break;
1598                 case NL80211_BSS_STATUS_IBSS_JOINED:
1599                         printf(" -- joined");
1600                         break;
1601                 default:
1602                         printf(" -- unknown status: %d",
1603                                 nla_get_u32(bss[NL80211_BSS_STATUS]));
1604                         break;
1605                 }
1606         }
1607         printf("\n");
1608
1609         if (bss[NL80211_BSS_TSF]) {
1610                 unsigned long long tsf;
1611                 tsf = (unsigned long long)nla_get_u64(bss[NL80211_BSS_TSF]);
1612                 printf("\tTSF: %llu usec (%llud, %.2lld:%.2llu:%.2llu)\n",
1613                         tsf, tsf/1000/1000/60/60/24, (tsf/1000/1000/60/60) % 24,
1614                         (tsf/1000/1000/60) % 60, (tsf/1000/1000) % 60);
1615         }
1616         if (bss[NL80211_BSS_FREQUENCY]) {
1617                 int freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
1618                 printf("\tfreq: %d\n", freq);
1619                 if (freq > 45000)
1620                         is_dmg = true;
1621         }
1622         if (bss[NL80211_BSS_BEACON_INTERVAL])
1623                 printf("\tbeacon interval: %d TUs\n",
1624                         nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]));
1625         if (bss[NL80211_BSS_CAPABILITY]) {
1626                 __u16 capa = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
1627                 printf("\tcapability:");
1628                 if (is_dmg)
1629                         print_capa_dmg(capa);
1630                 else
1631                         print_capa_non_dmg(capa);
1632                 printf(" (0x%.4x)\n", capa);
1633         }
1634         if (bss[NL80211_BSS_SIGNAL_MBM]) {
1635                 int s = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
1636                 printf("\tsignal: %d.%.2d dBm\n", s/100, s%100);
1637         }
1638         if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
1639                 unsigned char s = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
1640                 printf("\tsignal: %d/100\n", s);
1641         }
1642         if (bss[NL80211_BSS_SEEN_MS_AGO]) {
1643                 int age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
1644                 printf("\tlast seen: %d ms ago\n", age);
1645         }
1646
1647         if (bss[NL80211_BSS_INFORMATION_ELEMENTS] && show--) {
1648                 if (bss[NL80211_BSS_BEACON_IES])
1649                         printf("\tInformation elements from Probe Response "
1650                                "frame:\n");
1651                 print_ies(nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
1652                           nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
1653                           params->unknown, params->type);
1654         }
1655         if (bss[NL80211_BSS_BEACON_IES] && show--) {
1656                 printf("\tInformation elements from Beacon frame:\n");
1657                 print_ies(nla_data(bss[NL80211_BSS_BEACON_IES]),
1658                           nla_len(bss[NL80211_BSS_BEACON_IES]),
1659                           params->unknown, params->type);
1660         }
1661
1662         return NL_SKIP;
1663 }
1664
1665 static struct scan_params scan_params;
1666
1667 static int handle_scan_dump(struct nl80211_state *state,
1668                             struct nl_cb *cb,
1669                             struct nl_msg *msg,
1670                             int argc, char **argv,
1671                             enum id_input id)
1672 {
1673         if (argc > 1)
1674                 return 1;
1675
1676         memset(&scan_params, 0, sizeof(scan_params));
1677
1678         if (argc == 1 && !strcmp(argv[0], "-u"))
1679                 scan_params.unknown = true;
1680         else if (argc == 1 && !strcmp(argv[0], "-b"))
1681                 scan_params.show_both_ie_sets = true;
1682
1683         scan_params.type = PRINT_SCAN;
1684
1685         nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, print_bss_handler,
1686                   &scan_params);
1687         return 0;
1688 }
1689
1690 static int handle_scan_combined(struct nl80211_state *state,
1691                                 struct nl_cb *cb,
1692                                 struct nl_msg *msg,
1693                                 int argc, char **argv,
1694                                 enum id_input id)
1695 {
1696         char **trig_argv;
1697         static char *dump_argv[] = {
1698                 NULL,
1699                 "scan",
1700                 "dump",
1701                 NULL,
1702         };
1703         static const __u32 cmds[] = {
1704                 NL80211_CMD_NEW_SCAN_RESULTS,
1705                 NL80211_CMD_SCAN_ABORTED,
1706         };
1707         int trig_argc, dump_argc, err;
1708
1709         if (argc >= 3 && !strcmp(argv[2], "-u")) {
1710                 dump_argc = 4;
1711                 dump_argv[3] = "-u";
1712         } else if (argc >= 3 && !strcmp(argv[2], "-b")) {
1713                 dump_argc = 4;
1714                 dump_argv[3] = "-b";
1715         } else
1716                 dump_argc = 3;
1717
1718         trig_argc = 3 + (argc - 2) + (3 - dump_argc);
1719         trig_argv = calloc(trig_argc, sizeof(*trig_argv));
1720         if (!trig_argv)
1721                 return -ENOMEM;
1722         trig_argv[0] = argv[0];
1723         trig_argv[1] = "scan";
1724         trig_argv[2] = "trigger";
1725         int i;
1726         for (i = 0; i < argc - 2 - (dump_argc - 3); i++)
1727                 trig_argv[i + 3] = argv[i + 2 + (dump_argc - 3)];
1728         err = handle_cmd(state, id, trig_argc, trig_argv);
1729         free(trig_argv);
1730         if (err)
1731                 return err;
1732
1733         /*
1734          * WARNING: DO NOT COPY THIS CODE INTO YOUR APPLICATION
1735          *
1736          * This code has a bug, which requires creating a separate
1737          * nl80211 socket to fix:
1738          * It is possible for a NL80211_CMD_NEW_SCAN_RESULTS or
1739          * NL80211_CMD_SCAN_ABORTED message to be sent by the kernel
1740          * before (!) we listen to it, because we only start listening
1741          * after we send our scan request.
1742          *
1743          * Doing it the other way around has a race condition as well,
1744          * if you first open the events socket you may get a notification
1745          * for a previous scan.
1746          *
1747          * The only proper way to fix this would be to listen to events
1748          * before sending the command, and for the kernel to send the
1749          * scan request along with the event, so that you can match up
1750          * whether the scan you requested was finished or aborted (this
1751          * may result in processing a scan that another application
1752          * requested, but that doesn't seem to be a problem).
1753          *
1754          * Alas, the kernel doesn't do that (yet).
1755          */
1756
1757         if (listen_events(state, ARRAY_SIZE(cmds), cmds) ==
1758                                         NL80211_CMD_SCAN_ABORTED) {
1759                 printf("scan aborted!\n");
1760                 return 0;
1761         }
1762
1763         dump_argv[0] = argv[0];
1764         return handle_cmd(state, id, dump_argc, dump_argv);
1765 }
1766 TOPLEVEL(scan, "[-u] [freq <freq>*] [ies <hex as 00:11:..>] [meshid <meshid>] [lowpri,flush,ap-force] [ssid <ssid>*|passive]", 0, 0,
1767          CIB_NETDEV, handle_scan_combined,
1768          "Scan on the given frequencies and probe for the given SSIDs\n"
1769          "(or wildcard if not given) unless passive scanning is requested.\n"
1770          "If -u is specified print unknown data in the scan results.\n"
1771          "Specified (vendor) IEs must be well-formed.");
1772 COMMAND(scan, dump, "[-u]",
1773         NL80211_CMD_GET_SCAN, NLM_F_DUMP, CIB_NETDEV, handle_scan_dump,
1774         "Dump the current scan results. If -u is specified, print unknown\n"
1775         "data in scan results.");
1776 COMMAND(scan, trigger, "[freq <freq>*] [ies <hex as 00:11:..>] [meshid <meshid>] [lowpri,flush,ap-force] [ssid <ssid>*|passive]",
1777         NL80211_CMD_TRIGGER_SCAN, 0, CIB_NETDEV, handle_scan,
1778          "Trigger a scan on the given frequencies with probing for the given\n"
1779          "SSIDs (or wildcard if not given) unless passive scanning is requested.");